Lint using incorrect SDK version [157781491]

Fixed

Bug

Status Update

No update yet.

Description

ku...@gmail.com

created issue #1

May 30, 2020 01:00AM

Hello,

My team is hitting a flaky issue when running lint. It turns out lint will use the highest available installed Android SDK version for looking up the annotations.zip resource.

So if someone has android R preview installed, and someone else doesn't, their lint results are different for the same project. In most places lint is smart enough to use the compileSdkVersion that is set on the mainProject. That is except for annotations.zip and api-versions.xml.

Pulled from LintClient.kt:

// Look for annotations.zip or api-versions.xml: these used to ship with the
// platform-tools, but were (in API 26) moved over to the API platform.
// Look for the most recent version, falling back to platform-tools if necessary.
val targets = getTargets()
for (i in targets.indices.reversed()) {
    val target = targets[i]
    if (target.isPlatform && target.version.featureLevel >= SDK_DATABASE_MIN_VERSION) {
        val file = File(target.getFile(IAndroidTarget.DATA), relativePath)
            if (file.isFile) {
                return file
            }
        }
    }

But this really should use the target version of the mainProject rather than the highest installed version for consistent and reproducible results.

Comments

ku...@gmail.com <ku...@gmail.com> #2Jun 1, 2020 06:40PM

This happens on AGP Version 3.6.3. Still have to test if this behavior exists on AGP 4.0 as well

ku...@gmail.com <ku...@gmail.com> #3Jun 1, 2020 09:11PM

Was able to also reproduce this with AGP 4.0.0. You can reproduce this issue by adding the following method call to your codebase without any permissions in your manifest:

TelephonyManager telephonyManager = // ...;
telephonyManager.getNetworkType();

If you install the R preview SDK, a MissingPermission lint error will be raised (this seems to be a new permission requirement). If you uninstall that SDK, the error will disappear.

to...@gmail.com <to...@gmail.com> #4Jun 12, 2020 10:10PM

getNetworkType() require READ_PHONE_STATE permission since Android 10, I don't know why, I don't see any security issue there. It completely locks this function, because nobody has to have READ_PHONE_STATE :-( How to detect now network type (speed)?

And I think that this fact should be mentioned in the documentation.

to...@gmail.com <to...@gmail.com> #5Jun 12, 2020 10:13PM

Also documentation it is not mentioned that missing this permission don't cause exception, but it just returns 0 as NETWORK_TYPE_UNKNOWN

cp...@twitter.com <cp...@twitter.com> #6Jun 30, 2020 03:04PM

To be clear, the relevant bug here is not in the specific Lint report – the report itself is likely ok. The issue is that the outcome of the build on a specific machine depends on whether the Android R preview is installed or not. This caused our master to break for people installing the preview.

In my view, Lint should use the compilation SDK to select the target to use, instead of selecting the latest target that happens to be available in the machine.

tn...@google.com <tn...@google.com> Jun 30, 2020 03:11PM

Assigned to tn...@google.com.

tn...@google.com <tn...@google.com> #7Jun 30, 2020 04:42PM

Agreed. Lint was already doing this (using the SDK pointed to by compileSdkVersion) for the API lookup database, but not for the SDK annotations. This should be fixed by Change-Id: I837f3d6bcbee52b458619ad5fde4a2e2b2bd3bb7 in 4.2, and I'll also cherrypick it back to 4.1.

tn...@google.com <tn...@google.com> #8Jul 1, 2020 03:12PM

Marked as fixed.

Integrated. Thanks for the report!

cp...@twitter.com <cp...@twitter.com> #9Jul 2, 2020 12:09AM

Ohh thanks for the quick fix :))